ecdsa.h

+/* ecdsa.h
+
+   Copyright (C) 2013 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+/* Development of Nettle's ECC support was funded by the .SE Internet Fund. */
+
+#ifndef NETTLE_ECDSA_H_INCLUDED
+#define NETTLE_ECDSA_H_INCLUDED
+
+#include "ecc.h"
+#include "dsa.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Name mangling */
+#define ecdsa_sign nettle_ecdsa_sign
+#define ecdsa_verify nettle_ecdsa_verify
+#define ecdsa_generate_keypair nettle_ecdsa_generate_keypair
+#define ecc_ecdsa_sign nettle_ecc_ecdsa_sign
+#define ecc_ecdsa_sign_itch nettle_ecc_ecdsa_sign_itch
+#define ecc_ecdsa_verify nettle_ecc_ecdsa_verify
+#define ecc_ecdsa_verify_itch nettle_ecc_ecdsa_verify_itch
+
+/* High level ECDSA functions.
+ *
+ * A public key is represented as a struct ecc_point, and a private
+ * key as a struct ecc_scalar. */
+void
+ecdsa_sign (const struct ecc_scalar *key,
+	    void *random_ctx, nettle_random_func *random,
+	    size_t digest_length,
+	    const uint8_t *digest,
+	    struct dsa_signature *signature);
+
+int
+ecdsa_verify (const struct ecc_point *pub,
+	      size_t length, const uint8_t *digest,
+	      const struct dsa_signature *signature);
+
+void
+ecdsa_generate_keypair (struct ecc_point *pub,
+			struct ecc_scalar *key,
+			void *random_ctx, nettle_random_func *random);
+
+/* Low-level ECDSA functions. */
+mp_size_t
+ecc_ecdsa_sign_itch (const struct ecc_curve *ecc);
+
+void
+ecc_ecdsa_sign (const struct ecc_curve *ecc,
+		const mp_limb_t *zp,
+		/* Random nonce, must be invertible mod ecc group
+		   order. */
+		const mp_limb_t *kp,
+		size_t length, const uint8_t *digest,
+		mp_limb_t *rp, mp_limb_t *sp,
+		mp_limb_t *scratch);
+
+mp_size_t
+ecc_ecdsa_verify_itch (const struct ecc_curve *ecc);
+
+int
+ecc_ecdsa_verify (const struct ecc_curve *ecc,
+		  const mp_limb_t *pp, /* Public key */
+		  size_t length, const uint8_t *digest,
+		  const mp_limb_t *rp, const mp_limb_t *sp,
+		  mp_limb_t *scratch);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* NETTLE_ECDSA_H_INCLUDED */

ed25519-sha512-pubkey.c

+/* ed25519-sha512-pubkey.c
+
+   Copyright (C) 2014, 2015 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc-internal.h"
+#include "sha2.h"
+
+void
+ed25519_sha512_public_key (uint8_t *pub, const uint8_t *priv)
+{
+  const struct ecc_curve *ecc = &_nettle_curve25519;
+  struct sha512_ctx ctx;
+  uint8_t digest[SHA512_DIGEST_SIZE];
+  mp_size_t itch = ecc->q.size + _eddsa_public_key_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+
+#define k scratch
+#define scratch_out (scratch + ecc->q.size)
+  sha512_init (&ctx);
+  _eddsa_expand_key (ecc, &_nettle_ed25519_sha512, &ctx, priv, digest, k);
+  _eddsa_public_key (ecc, k, pub, scratch_out);
+
+  gmp_free_limbs (scratch, itch);
+#undef k
+#undef scratch_out
+}

ed25519-sha512-sign.c

+/* ed25519-sha512-sign.c
+
+   Copyright (C) 2014, 2015 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc-internal.h"
+#include "sha2.h"
+
+void
+ed25519_sha512_sign (const uint8_t *pub,
+		     const uint8_t *priv,
+		     size_t length, const uint8_t *msg,
+		     uint8_t *signature)
+{
+  const struct ecc_curve *ecc = &_nettle_curve25519;
+  mp_size_t itch = ecc->q.size + _eddsa_sign_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+#define k2 scratch
+#define scratch_out (scratch + ecc->q.size)
+  struct sha512_ctx ctx;
+  uint8_t digest[SHA512_DIGEST_SIZE];
+
+  sha512_init (&ctx);
+  _eddsa_expand_key (ecc, &_nettle_ed25519_sha512, &ctx, priv, digest, k2);
+
+  _eddsa_sign (ecc, &_nettle_ed25519_sha512, &ctx,
+	       pub, digest + ED25519_KEY_SIZE, k2,
+	       length, msg, signature, scratch_out);
+
+  gmp_free_limbs (scratch, itch);
+#undef k1
+#undef k2
+#undef scratch_out
+}

ed25519-sha512-verify.c

+/* ed25519-sha512-verify.c
+
+   Copyright (C) 2014, 2015 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <string.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc-internal.h"
+#include "sha2.h"
+
+int
+ed25519_sha512_verify (const uint8_t *pub,
+		       size_t length, const uint8_t *msg,
+		       const uint8_t *signature)
+{
+  const struct ecc_curve *ecc = &_nettle_curve25519;
+  mp_size_t itch = 3*ecc->p.size + _eddsa_verify_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+  struct sha512_ctx ctx;
+  int res;
+#define A scratch
+#define scratch_out (scratch + 3*ecc->p.size)
+
+  sha512_init (&ctx);
+  res = (_eddsa_decompress (ecc,
+			    A, pub, scratch_out)
+	 && _eddsa_verify (ecc, &_nettle_ed25519_sha512,
+			   pub, A, &ctx,
+			   length, msg, signature,
+			   scratch_out));
+  gmp_free_limbs (scratch, itch);
+  return res;
+#undef A
+#undef scratch_out
+}

ed25519-sha512.c

+/* ed25519-sha512.c
+
+   Copyright (C) 2019 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa-internal.h"
+
+#include "nettle-types.h"
+#include "sha2.h"
+
+static nettle_eddsa_dom_func ed25519_dom;
+
+static void ed25519_dom(void *ctx UNUSED) {}
+
+const struct ecc_eddsa _nettle_ed25519_sha512 =
+  {
+    (nettle_hash_update_func *) sha512_update,
+    (nettle_hash_digest_func *) sha512_digest,
+    ed25519_dom,
+    ~(mp_limb_t) 7,
+    (mp_limb_t) 1 << (254 % GMP_NUMB_BITS),
+  };

ed448-shake256-pubkey.c

+/* ed448-shake256-pubkey.c
+
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv)
+{
+  const struct ecc_curve *ecc = &_nettle_curve448;
+  struct sha3_256_ctx ctx;
+  uint8_t digest[ED448_SIGNATURE_SIZE];
+  mp_size_t itch = ecc->q.size + _eddsa_public_key_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+
+#define k scratch
+#define scratch_out (scratch + ecc->q.size)
+  sha3_256_init (&ctx);
+  _eddsa_expand_key (ecc, &_nettle_ed448_shake256, &ctx, priv, digest, k);
+  _eddsa_public_key (ecc, k, pub, scratch_out);
+
+  gmp_free_limbs (scratch, itch);
+#undef k
+#undef scratch_out
+}

ed448-shake256-sign.c

+/* ed448-shake256-sign.c
+
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+		     const uint8_t *priv,
+		     size_t length, const uint8_t *msg,
+		     uint8_t *signature)
+{
+  const struct ecc_curve *ecc = &_nettle_curve448;
+  const struct ecc_eddsa *eddsa = &_nettle_ed448_shake256;
+  mp_size_t itch = ecc->q.size + _eddsa_sign_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+#define k2 scratch
+#define scratch_out (scratch + ecc->q.size)
+  struct sha3_256_ctx ctx;
+  uint8_t digest[ED448_SIGNATURE_SIZE];
+
+  sha3_256_init (&ctx);
+  _eddsa_expand_key (ecc, eddsa, &ctx, priv, digest, k2);
+
+  _eddsa_sign (ecc, eddsa, &ctx,
+	       pub, digest + ED448_KEY_SIZE, k2,
+	       length, msg, signature, scratch_out);
+
+  gmp_free_limbs (scratch, itch);
+#undef k1
+#undef k2
+#undef scratch_out
+}

ed448-shake256-verify.c

+/* ed448-shake256-verify.c
+
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <string.h>
+
+#include "eddsa.h"
+
+#include "ecc-internal.h"
+#include "eddsa-internal.h"
+#include "sha3.h"
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+		       size_t length, const uint8_t *msg,
+		       const uint8_t *signature)
+{
+  const struct ecc_curve *ecc = &_nettle_curve448;
+  mp_size_t itch = 3*ecc->p.size + _eddsa_verify_itch (ecc);
+  mp_limb_t *scratch = gmp_alloc_limbs (itch);
+  struct sha3_256_ctx ctx;
+  int res;
+#define A scratch
+#define scratch_out (scratch + 3*ecc->p.size)
+  sha3_256_init (&ctx);
+
+  res = (_eddsa_decompress (ecc,
+			    A, pub, scratch_out)
+	 && _eddsa_verify (ecc, &_nettle_ed448_shake256, pub, A,
+			   &ctx,
+			   length, msg, signature,
+			   scratch_out));
+  gmp_free_limbs (scratch, itch);
+  return res;
+#undef A
+#undef scratch_out
+}

ed448-shake256.c

+/* ed448-shake256.c
+
+   Copyright (C) 2019 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "nettle-types.h"
+#include "sha3.h"
+
+#define DOM_SIZE 10
+
+static nettle_eddsa_dom_func ed448_dom;
+
+static void
+ed448_dom(void *ctx)
+{
+  static const uint8_t dom[DOM_SIZE] =
+    { 'S', 'i', 'g', 'E', 'd', '4', '4', '8', 0, 0};
+  sha3_256_update (ctx, DOM_SIZE, dom);
+}
+
+static void
+ed448_digest(struct sha3_256_ctx *ctx, uint8_t *digest)
+{
+  sha3_256_shake(ctx, 2*ED448_KEY_SIZE, digest);
+}
+
+const struct ecc_eddsa _nettle_ed448_shake256 =
+  {
+    (nettle_hash_update_func *) sha3_256_update,
+    (nettle_hash_digest_func *) ed448_digest,
+    ed448_dom,
+    ~(mp_limb_t) 3,
+    (mp_limb_t) 1 << (447 % GMP_NUMB_BITS),
+  };

eddsa-compress.c

+/* eddsa-compress.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc-internal.h"
+#include "gmp-glue.h"
+
+mp_size_t
+_eddsa_compress_itch (const struct ecc_curve *ecc)
+{
+  return 2*ecc->p.size + ecc->h_to_a_itch;
+}
+
+void
+_eddsa_compress (const struct ecc_curve *ecc, uint8_t *r, mp_limb_t *p,
+		 mp_limb_t *scratch)
+{
+#define xp scratch
+#define yp (scratch + ecc->p.size)
+#define scratch_out (scratch + 2*ecc->p.size)
+
+  size_t nbytes = 1 + ecc->p.bit_size / 8;
+  ecc->h_to_a (ecc, 0, xp, p, scratch_out);
+  /* Encoding is the y coordinate and an appended "sign" bit, which is
+     the low bit of x. The sign bit is stored as the most significant
+     bit of the last byte. */
+  mpn_get_base256_le (r, nbytes, yp, ecc->p.size);
+  r[nbytes - 1] += (xp[0] & 1) << 7;
+}

eddsa-decompress.c

+/* eddsa-decompress.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc-internal.h"
+#include "gmp-glue.h"
+
+mp_size_t
+_eddsa_decompress_itch (const struct ecc_curve *ecc)
+{
+  return 4*ecc->p.size + ecc->p.sqrt_ratio_itch;
+}
+
+int
+_eddsa_decompress (const struct ecc_curve *ecc, mp_limb_t *p,
+		   const uint8_t *cp,
+		   mp_limb_t *scratch)
+{
+  mp_limb_t sign, cy;
+  mp_size_t nlimbs;
+  size_t nbytes;
+  int res;
+
+#define xp p
+#define yp (p + ecc->p.size)
+
+#define y2 scratch
+#define vp (scratch + ecc->p.size)
+#define up scratch
+#define tp (scratch + 2*ecc->p.size)
+#define scratch_out (scratch + 4*ecc->p.size)
+
+  nbytes = 1 + ecc->p.bit_size / 8;
+  /* By RFC 8032, sign bit is always the most significant bit of the
+     last byte. */
+  sign = cp[nbytes-1] >> 7;
+
+  /* May need an extra limb. */
+  nlimbs = (nbytes * 8 + GMP_NUMB_BITS - 1) / GMP_NUMB_BITS;
+  assert (nlimbs <= ecc->p.size + 1);
+  mpn_set_base256_le (scratch, nlimbs, cp, nbytes);
+
+  /* Clear out the sign bit */
+  scratch[nlimbs - 1] &=
+    ((mp_limb_t) 1 << ((nbytes * 8 - 1) % GMP_NUMB_BITS)) - 1;
+  mpn_copyi (yp, scratch, ecc->p.size);
+
+  /* Check range. */
+  if (nlimbs > ecc->p.size)
+    res = is_zero_limb (scratch[nlimbs - 1]);
+  else
+    res = 1;
+
+  /* For a valid input, y < p, so subtraction should underflow. */
+  res &= mpn_sub_n (scratch, scratch, ecc->p.m, ecc->p.size);
+
+  ecc_mod_sqr (&ecc->p, y2, yp, y2);
+  ecc_mod_mul (&ecc->p, vp, y2, ecc->b, vp);
+  ecc_mod_sub (&ecc->p, vp, vp, ecc->unit);
+  /* The sign is different between curve25519 and curve448.  */
+  if (ecc->p.bit_size == 255)
+    ecc_mod_sub (&ecc->p, up, ecc->unit, y2);
+  else
+    ecc_mod_sub (&ecc->p, up, y2, ecc->unit);
+  res &= ecc->p.sqrt_ratio (&ecc->p, tp, up, vp, scratch_out);
+
+  cy = mpn_sub_n (xp, tp, ecc->p.m, ecc->p.size);
+  cnd_copy (cy, xp, tp, ecc->p.size);
+  sign ^= xp[0] & 1;
+  mpn_sub_n (tp, ecc->p.m, xp, ecc->p.size);
+  cnd_copy (sign, xp, tp, ecc->p.size);
+  /* Fails if the square root is zero but (original) sign was 1 */
+  res &= mpn_sub_n (tp, xp, ecc->p.m, ecc->p.size);
+  return res;
+}

eddsa-expand.c

+/* eddsa-expand.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+#include <string.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc.h"
+#include "ecc-internal.h"
+
+/* Expands a private key, generating the secret scalar K2 and leaving
+   the key K1 for nonce generation, at the end of the digest. */
+void
+_eddsa_expand_key (const struct ecc_curve *ecc,
+		   const struct ecc_eddsa *eddsa,
+		   void *ctx,
+		   const uint8_t *key,
+		   uint8_t *digest,
+		   mp_limb_t *k2)
+{
+  size_t nbytes = 1 + ecc->p.bit_size / 8;
+
+  eddsa->update (ctx, nbytes, key);
+  eddsa->digest (ctx, digest);
+
+  /* For ed448, ignores the most significant byte. */
+  mpn_set_base256_le (k2, ecc->p.size, digest, (ecc->p.bit_size + 7) / 8);
+
+  /* Clear low c bits */
+  k2[0] &= eddsa->low_mask;
+
+  /* Clear higher bits. */
+  k2[ecc->p.size - 1] &= eddsa->high_bit - 1;
+
+  /* Set bit number bit_size - 1 (bit 254 for curve25519, bit 447 for
+     curve448) */
+  k2[ecc->p.size - 1] |= eddsa->high_bit;
+}

eddsa-hash.c

+/* eddsa-hash.c
+
+   Copyright (C) 2014, 2019 Niels Möller
+   Copyright (C) 2017 Daiki Ueno
+   Copyright (C) 2017 Red Hat, Inc.
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc.h"
+#include "ecc-internal.h"
+#include "nettle-internal.h"
+
+/* Convert hash digest to integer, and reduce canonically modulo q.
+   Needs space for 2*m->size + 1 at rp. */
+void
+_eddsa_hash (const struct ecc_modulo *m,
+	     mp_limb_t *rp, size_t digest_size, const uint8_t *digest)
+{
+  mp_size_t nlimbs = NETTLE_OCTET_SIZE_TO_LIMB_SIZE (digest_size);
+  mp_limb_t cy;
+
+  mpn_set_base256_le (rp, nlimbs, digest, digest_size);
+
+  if (nlimbs > 2*m->size)
+    {
+      /* Special case for Ed448: reduce rp to 2*m->size limbs.
+	 After decoding rp from a hash of size 2*rn:
+
+	 rp = r2 || r1 || r0
+
+	 where r0 and r1 have m->size limbs.  Reduce this to:
+
+	 rp = r1' || r0
+
+	 where r1' has m->size limbs.  */
+      mp_limb_t hi = rp[2*m->size];
+      assert (nlimbs == 2*m->size + 1);
+
+      hi = mpn_addmul_1 (rp + m->size, m->B, m->size, hi);
+      assert_maybe (hi <= 1);
+      hi = mpn_cnd_add_n (hi, rp + m->size, rp + m->size, m->B, m->size);
+      assert_maybe (hi == 0);
+    }
+  m->mod (m, rp + m->size , rp);
+  /* Ensure canonical reduction. */
+  cy = mpn_sub_n (rp, rp + m->size, m->m, m->size);
+  cnd_copy (cy, rp, rp + m->size, m->size);
+}

eddsa-internal.h

+/* eddsa.h
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_EDDSA_INTERNAL_H
+#define NETTLE_EDDSA_INTERNAL_H
+
+#include "nettle-types.h"
+#include "bignum.h"
+
+#define _eddsa_compress _nettle_eddsa_compress
+#define _eddsa_compress_itch _nettle_eddsa_compress_itch
+#define _eddsa_decompress _nettle_eddsa_decompress
+#define _eddsa_decompress_itch _nettle_eddsa_decompress_itch
+#define _eddsa_hash _nettle_eddsa_hash
+#define _eddsa_expand_key _nettle_eddsa_expand_key
+#define _eddsa_sign _nettle_eddsa_sign
+#define _eddsa_sign_itch _nettle_eddsa_sign_itch
+#define _eddsa_verify _nettle_eddsa_verify
+#define _eddsa_verify_itch _nettle_eddsa_verify_itch
+#define _eddsa_public_key_itch _nettle_eddsa_public_key_itch
+#define _eddsa_public_key _nettle_eddsa_public_key
+
+/* Low-level internal functions */
+
+struct ecc_curve;
+struct ecc_modulo;
+
+typedef void nettle_eddsa_dom_func(void *ctx);
+
+struct ecc_eddsa
+{
+  /* Hash function to use, digest size must be 2*key-size. */
+  nettle_hash_update_func *update;
+  nettle_hash_digest_func *digest;
+  nettle_eddsa_dom_func *dom;
+  /* For generating the secret scalar */
+  mp_limb_t low_mask;
+  mp_limb_t high_bit;
+};
+
+extern const struct ecc_eddsa _nettle_ed25519_sha512;
+extern const struct ecc_eddsa _nettle_ed448_shake256;
+
+mp_size_t
+_eddsa_compress_itch (const struct ecc_curve *ecc);
+void
+_eddsa_compress (const struct ecc_curve *ecc, uint8_t *r, mp_limb_t *p,
+		 mp_limb_t *scratch);
+
+mp_size_t
+_eddsa_decompress_itch (const struct ecc_curve *ecc);
+int
+_eddsa_decompress (const struct ecc_curve *ecc, mp_limb_t *p,
+		   const uint8_t *cp,
+		   mp_limb_t *scratch);
+
+void
+_eddsa_hash (const struct ecc_modulo *m,
+	     mp_limb_t *rp, size_t digest_size, const uint8_t *digest);
+
+mp_size_t
+_eddsa_sign_itch (const struct ecc_curve *ecc);
+
+void
+_eddsa_sign (const struct ecc_curve *ecc,
+	     const struct ecc_eddsa *eddsa,
+	     void *ctx,
+	     const uint8_t *pub,
+	     const uint8_t *k1,
+	     const mp_limb_t *k2,
+	     size_t length,
+	     const uint8_t *msg,
+	     uint8_t *signature,
+	     mp_limb_t *scratch);
+
+mp_size_t
+_eddsa_verify_itch (const struct ecc_curve *ecc);
+
+int
+_eddsa_verify (const struct ecc_curve *ecc,
+	       const struct ecc_eddsa *eddsa,
+	       const uint8_t *pub,
+	       const mp_limb_t *A,
+	       void *ctx,
+	       size_t length,
+	       const uint8_t *msg,
+	       const uint8_t *signature,
+	       mp_limb_t *scratch);
+
+void
+_eddsa_expand_key (const struct ecc_curve *ecc,
+		   const struct ecc_eddsa *eddsa,
+		   void *ctx,
+		   const uint8_t *key,
+		   uint8_t *digest,
+		   mp_limb_t *k2);
+
+mp_size_t
+_eddsa_public_key_itch (const struct ecc_curve *ecc);
+
+void
+_eddsa_public_key (const struct ecc_curve *ecc,
+		   const mp_limb_t *k, uint8_t *pub, mp_limb_t *scratch);
+
+#endif /* NETTLE_EDDSA_INTERNAL_H */

eddsa-pubkey.c

+/* eddsa-pubkey.c
+
+   Copyright (C) 2015 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc-internal.h"
+
+mp_size_t
+_eddsa_public_key_itch (const struct ecc_curve *ecc)
+{
+  assert (ecc->mul_g_itch <= _eddsa_compress_itch (ecc));
+  return 3*ecc->p.size + _eddsa_compress_itch (ecc);
+}
+
+void
+_eddsa_public_key (const struct ecc_curve *ecc,
+		   const mp_limb_t *k, uint8_t *pub, mp_limb_t *scratch)
+{
+#define P scratch
+#define scratch_out (scratch + 3*ecc->p.size)
+  ecc->mul_g (ecc, P, k, scratch_out);
+  _eddsa_compress (ecc, pub, P, scratch_out);
+#undef P
+#undef scratch_out
+}

eddsa-sign.c

+/* eddsa-sign.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc.h"
+#include "ecc-internal.h"
+#include "nettle-meta.h"
+
+mp_size_t
+_eddsa_sign_itch (const struct ecc_curve *ecc)
+{
+  assert (ecc->mul_g_itch <= _eddsa_compress_itch (ecc));
+  return 5*ecc->p.size + _eddsa_compress_itch (ecc);
+}
+
+void
+_eddsa_sign (const struct ecc_curve *ecc,
+	     const struct ecc_eddsa *eddsa,
+	     void *ctx,
+	     const uint8_t *pub,
+	     const uint8_t *k1,
+	     const mp_limb_t *k2,
+	     size_t length,
+	     const uint8_t *msg,
+	     uint8_t *signature,
+	     mp_limb_t *scratch)
+{
+  mp_size_t size;
+  size_t nbytes;
+  mp_limb_t q, cy;
+
+#define rp scratch
+#define hp (scratch + size)
+#define P (scratch + 2*size)
+#define sp (scratch + 2*size)
+#define hash ((uint8_t *) (scratch + 3*size))
+#define scratch_out (scratch + 5*size)
+
+  size = ecc->p.size;
+  nbytes = 1 + ecc->p.bit_size / 8;
+
+  eddsa->dom (ctx);
+  eddsa->update (ctx, nbytes, k1);
+  eddsa->update (ctx, length, msg);
+  eddsa->digest (ctx, hash);
+  _eddsa_hash (&ecc->q, rp, 2*nbytes, hash);
+
+  ecc->mul_g (ecc, P, rp, scratch_out);
+  _eddsa_compress (ecc, signature, P, scratch_out);
+
+  eddsa->dom (ctx);
+  eddsa->update (ctx, nbytes, signature);
+  eddsa->update (ctx, nbytes, pub);
+  eddsa->update (ctx, length, msg);
+  eddsa->digest (ctx, hash);
+  _eddsa_hash (&ecc->q, hp, 2*nbytes, hash);
+
+  ecc_mod_mul (&ecc->q, sp, hp, k2, sp);
+  ecc_mod_add (&ecc->q, sp, sp, rp); /* FIXME: Can be plain add */
+  if (ecc->p.bit_size == 255)
+    {
+      /* FIXME: Special code duplicated in ecc_curve25519_modq
+	 Define a suitable method for canonical reduction? */
+
+      /* q is slightly larger than 2^252, underflow from below
+	 mpn_submul_1 is unlikely. */
+      unsigned shift = 252 - GMP_NUMB_BITS * (ecc->p.size - 1);
+      q = sp[ecc->p.size-1] >> shift;
+    }
+  else
+    {
+      unsigned shift;
+
+      assert (ecc->p.bit_size == 448);
+      /* q is slightly smaller than 2^446 */
+      shift = 446 - GMP_NUMB_BITS * (ecc->p.size - 1);
+      /* Add one, then it's possible but unlikely that below
+	 mpn_submul_1 does *not* underflow. */
+      q = (sp[ecc->p.size-1] >> shift) + 1;
+    }
+
+  cy = mpn_submul_1 (sp, ecc->q.m, ecc->p.size, q);
+  assert_maybe (cy < 2);
+  cy -= mpn_cnd_add_n (cy, sp, sp, ecc->q.m, ecc->p.size);
+  assert_maybe (cy == 0);
+
+  mpn_get_base256_le (signature + nbytes, nbytes, sp, ecc->q.size);
+#undef rp
+#undef hp
+#undef P
+#undef sp
+#undef hash
+}

eddsa-verify.c

+/* eddsa-verify.c
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#if HAVE_CONFIG_H
+# include "config.h"
+#endif
+
+#include <assert.h>
+
+#include "eddsa.h"
+#include "eddsa-internal.h"
+
+#include "ecc.h"
+#include "ecc-internal.h"
+#include "nettle-meta.h"
+
+/* Checks if x1/z1 == x2/z2 (mod p). Assumes z1 and z2 are
+   non-zero. */
+static int
+equal_h (const struct ecc_modulo *p,
+	 const mp_limb_t *x1, const mp_limb_t *z1,
+	 const mp_limb_t *x2, const mp_limb_t *z2,
+	 mp_limb_t *scratch)
+{
+#define t0 scratch
+#define t1 (scratch + p->size)
+
+  ecc_mod_mul_canonical (p, t0, x1, z2, t0);
+  ecc_mod_mul_canonical (p, t1, x2, z1, t1);
+
+  return mpn_cmp (t0, t1, p->size) == 0;
+
+#undef t0
+#undef t1
+}
+
+mp_size_t
+_eddsa_verify_itch (const struct ecc_curve *ecc)
+{
+  assert (_eddsa_decompress_itch (ecc) <= ecc->mul_itch);
+  return 8*ecc->p.size + ecc->mul_itch;
+}
+
+int
+_eddsa_verify (const struct ecc_curve *ecc,
+	       const struct ecc_eddsa *eddsa,
+	       const uint8_t *pub,
+	       const mp_limb_t *A,
+	       void *ctx,
+	       size_t length,
+	       const uint8_t *msg,
+	       const uint8_t *signature,
+	       mp_limb_t *scratch)
+{
+  size_t nbytes;
+#define R scratch
+#define sp (scratch + 2*ecc->p.size)
+#define hp (scratch + 3*ecc->p.size)
+#define P (scratch + 5*ecc->p.size)
+#define scratch_out (scratch + 8*ecc->p.size)
+#define S R
+#define hash ((uint8_t *) P)
+
+  nbytes = 1 + ecc->p.bit_size / 8;
+
+  /* Could maybe save some storage by delaying the R and S operations,
+     but it makes sense to check them for validity up front. */
+  if (!_eddsa_decompress (ecc, R, signature, R+2*ecc->p.size))
+    return 0;
+
+  mpn_set_base256_le (sp, ecc->q.size, signature + nbytes, nbytes);
+  /* Check that s < q */
+  if (mpn_cmp (sp, ecc->q.m, ecc->q.size) >= 0)
+    return 0;
+
+  eddsa->dom (ctx);
+  eddsa->update (ctx, nbytes, signature);
+  eddsa->update (ctx, nbytes, pub);
+  eddsa->update (ctx, length, msg);
+  eddsa->digest (ctx, hash);
+  _eddsa_hash (&ecc->q, hp, 2*nbytes, hash);
+
+  /* Compute h A + R - s G, which should be the neutral point */
+  ecc->mul (ecc, P, hp, A, scratch_out);
+  ecc->add_hh (ecc, P, P, R, scratch_out);
+  /* Move out of the way. */
+  mpn_copyi (hp, sp, ecc->q.size);
+  ecc->mul_g (ecc, S, hp, scratch_out);
+
+  return equal_h (&ecc->p,
+		   P, P + 2*ecc->p.size,
+		   S, S + 2*ecc->p.size, scratch_out)
+    && equal_h (&ecc->p,
+		P + ecc->p.size, P + 2*ecc->p.size,
+		S + ecc->p.size, S + 2*ecc->p.size, scratch_out);
+
+#undef R
+#undef sp
+#undef hp
+#undef P
+#undef S
+}

eddsa.h

+/* eddsa.h
+
+   Copyright (C) 2014 Niels Möller
+
+   This file is part of GNU Nettle.
+
+   GNU Nettle is free software: you can redistribute it and/or
+   modify it under the terms of either:
+
+     * the GNU Lesser General Public License as published by the Free
+       Software Foundation; either version 3 of the License, or (at your
+       option) any later version.
+
+   or
+
+     * the GNU General Public License as published by the Free
+       Software Foundation; either version 2 of the License, or (at your
+       option) any later version.
+
+   or both in parallel, as here.
+
+   GNU Nettle is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   General Public License for more details.
+
+   You should have received copies of the GNU General Public License and
+   the GNU Lesser General Public License along with this program.  If
+   not, see http://www.gnu.org/licenses/.
+*/
+
+#ifndef NETTLE_EDDSA_H
+#define NETTLE_EDDSA_H
+
+#include "nettle-types.h"
+
+#include "bignum.h"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Name mangling */
+#define ed25519_sha512_set_private_key nettle_ed25519_sha512_set_private_key
+#define ed25519_sha512_public_key nettle_ed25519_sha512_public_key
+#define ed25519_sha512_sign nettle_ed25519_sha512_sign
+#define ed25519_sha512_verify nettle_ed25519_sha512_verify
+#define ed448_shake256_public_key nettle_ed448_shake256_public_key
+#define ed448_shake256_sign nettle_ed448_shake256_sign
+#define ed448_shake256_verify nettle_ed448_shake256_verify
+
+#define ED25519_KEY_SIZE 32
+#define ED25519_SIGNATURE_SIZE 64
+
+void
+ed25519_sha512_public_key (uint8_t *pub, const uint8_t *priv);
+
+void
+ed25519_sha512_sign (const uint8_t *pub,
+		     const uint8_t *priv,		     
+		     size_t length, const uint8_t *msg,
+		     uint8_t *signature);
+
+int
+ed25519_sha512_verify (const uint8_t *pub,
+		       size_t length, const uint8_t *msg,
+		       const uint8_t *signature);
+
+#define ED448_KEY_SIZE 57
+#define ED448_SIGNATURE_SIZE 114
+
+void
+ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv);
+
+void
+ed448_shake256_sign (const uint8_t *pub,
+		     const uint8_t *priv,
+		     size_t length, const uint8_t *msg,
+		     uint8_t *signature);
+
+int
+ed448_shake256_verify (const uint8_t *pub,
+		       size_t length, const uint8_t *msg,
+		       const uint8_t *signature);
+			   
+#ifdef __cplusplus
+}
+#endif
+
+#endif /* NETTLE_EDDSA_H */

examples/.cvsignore

-.deps
-Makefile
-Makefile.in
-nettle-benchmark
-rsa-decrypt
-rsa-encrypt
-rsa-keygen
-rsa-sign
-rsa-verify
-sexp-conv
-test*

examples/.gitignore

-/.deps
+/*.d
 /Makefile
-/Makefile.in
+/base16dec
+/base16enc
+/base64dec
+/base64enc
+/ecc-benchmark
+/eratosthenes
+/hogweed-benchmark
 /nettle-benchmark
+/next-prime
+/random-prime
 /rsa-decrypt
 /rsa-encrypt
 /rsa-keygen